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AMENDMENTS TO THE CLAIMS 

1. (Original) A system for early warning in an e-service management system, comprising: 
a statistical learning mechanism for performing statistical learning based on a plurality of 

data values of a variable to generate a statistical model characterizing the behavior of the 
variable; 

an early warning mechanism for generating an early warning of threshold violation of the 
variable with respect to a threshold by predicting, based on the statistical model, a future time by 
which the values of the variable exceeds the threshold; and 

an operational mechanism for detecting abnormal behavior of the variable based on both 
the statistical model and the early warning. 

2. (Currently amended) The system according to claim 1, wherein the statistical learning 
mechanism comprises: 

an offline normal behavior modeling mechanism for modeling the regular behavior of the 
variable based on the plurality of values of the variable collected offline over a period of time; 
and 

an online behavior modeling mechanism for modaling modeling the dynamic behavior of 
the variable based on a plurality of values of the variable collected online during the operations 
performed by the operational mechanism. 

3. (Currently amended) A method for early warning in an e-service management system, 
comprising: 

modeling the behavior of a variable based on a plurality of data values of the variable 
collected over a period of time, said modeling being performed based on the statistical properties 
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of the data values of the variable to generate a behavior model for the variable, the behavior 
model being represented using a plurality of model parameters; 

generating an early warning for a threshold violation of the variable with respect to a 
threshold based on a plurality of data values of the variable collected online and the behavior 
model; and 

detecting abnormal behavior of the variable according to the plurality of data values of 
the variable collected online and the early warning. 

4. (Original) The method according to claim 3 3 wherein the modeling comprises: 
establishing, by an offline normal behavior modeling mechanism, a first statistical model 

that characterizes the regular behavior of the variable based on a first set of values of the variable 
collected offline over a period of time; and 

establishing a second statistical model that characterizes the dynamic behavior of the 
variable based on a second set of values of said variable collected online, said first and said 
second statistical model comprising said behavior model. 

5. (Original) The method according to claim 3, wherein generating an early warning 
comprises: 

computing a plurality of residuals at corresponding different time reference points in the 
future based on the model parameters; deriving the variances of the plurality of residuals, 
predicted by said predicting; 

estimating the probabilities for threshold violation of the variable with respect to said 
threshold at the corresponding different time reference points in the future; and 

issuing an early warning for any of the time reference points at which the probability for 
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threshold violation of the variable exceeds a pre-determined value. 

6. (Currently amended) The method according to claim 5, wherein the estimating the 
probabilities comprises: 

translating the threshold for the variable to corresponding residual threshold for the 
residual of the variable; and 

calculating the probabilities for threshold violation of the residual with respect to the 
residual threshold at the corresponding different time reference points in the future. 

7. (Currently amended) A computer-readable medium encoded with a program for early 
warning in an e-service management system, the program comprising: program, when e x e cut e d, 
causing : 

modeling the behavior of a variable based on a plurality of data values of the variable 
collected over a period of time, said modeling being performed based on the statistical properties 
of the data values of the variable to generate a behavior model for the variable, the behavior 
model being represented using a plurality of model parameters; 

generating an early warning for a threshold violation of the variable with respect to a 
threshold based on a plurality of data values of the variable collected online and the behavior 
model; and 

detecting abnormal behavior of the variable according to the plurality of data values of 
the variable collected online and the early warning. 

8. (Original) The medium according to claim 7, wherein the modeling comprises: 
establishing, by an offline normal behavior modeling mechanism, a first statistical model 
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that characterizes the regular behavior of the variable based on a first set of values of the variable 
collected offline over a period of time; and 

establishing a second statistical model that characterizes the dynamic behavior of the 
variable based on a second set of values of said variable collected online, said first and said 
second statistical model comprising said behavior model. 

9. (Currently amended) The medium according to claim 7, wherein generating an early 
warning comprises: 

computing a plurality of residuals at corresponding corresponding to different time 
reference points in the future based on the model parameters; 

deriving the variances of the plurality of residuals, predicted by said predicting; 

estimating the probabilities for threshold violation of the variable with respect to said 
threshold at the corresponding different time reference points in the future; and 

issuing an early warning for any of the time reference points at which the probability for 
threshold violation of the variable exceeds a pre-determined value. 

10. (Currently amended) The medium according to claim 9, wherein the estimating the 
probabilities comprises: 

translating the threshold for the variable to corresponding residual threshold for the 
residual of the variable; and 

calculating the probabilities for threshold violation of the residual with respect to the 
residual threshold at the corresponding different time reference points in the future. 
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11. (New) The system as claimed in claim 1, wherein the thresholds corresponding to 
future times are distinct based on time of day and day of week. 



12. (New) The system as claimed in claim 1, wherein the detection of abnormal behavior 
is further based on criteria derived from a business process model. 

13. (New) The system as claimed in claim 2, wherein the online behavior modeling 
mechanism includes a sliding window. 

14. (New) The system as claimed in claim 13, wherein the sliding window is used to 
determine stationarity segments of the variable and the times corresponding to boundaries of the 
stationarity segments. 

15. (New) The system as claimed in claim 13, wherein the width of the sliding window is 
configurable parameter. 

16. (New) The method as claimed in claim 3, wherein the modeling of the behavior of the 
variable includes detecting time segments of stationarity and the times corresponding to the 
boundaries of these stationarity segments. 

17. (New) The method as claimed in claim 3, wherein detecting abnormal behavior of the 
variable is further according to criteria derived from a business process model. 
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18. (New) The method as claimed in claim 5, wherein the residuals corresponding to 
different time points in the future comprise a distinct value depending on the time of day, day of 
week, and week of month of the future time. 

19. (New) The method as claimed in claim 5, wherein the number of time reference 
points and the pre-determined threshold violation value are configurable parameters. 

20. (New) The method as claimed in claim 5, wherein the number of time reference 
points and the pre-determined threshold violation value are derived from a business process 
model. 

21 . (New) The computer-readable medium as claimed in claim 7, wherein the threshold is 
further based on criteria derived from a business process model. 

22. (New) The computer-readable medium as claimed in claim 7, wherein the threshold is 
a distinct value based on time of day and day of week. 

23. (New) The computer-readable medium as claimed in claim 8, wherein the modeling 
of the behavior of the variable includes detecting time segments of stationarity and the times 
corresponding to the boundaries of these stationarity segments. 

24. (New) The computer-readable medium as claimed in claim 8, wherein modeling of 
the behavior of the variable includes the use of a sliding window. 
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